REMARKS 

Claim 19 has been amended to clarify the subject matter regarded as the invention. 
Claims 1-11, 13, 15-17, 19-21 are pending. 

Claims 1-2, 10-1 1 stand rejected under 35 U.S. C. 103(a) as being unpatentable over 
I' Anson, further in view of Sweitzer and Shanklin. Claims 3-4 stand rejected under 35 U.S.C. 
103(a) as being unpatentable over F Anson, Shanklin, Sweitzer and further in view of Wijendran. 
Claim 5 stand rejected under 35 U.S.C. 103(a) as being unpatentable over FAnson, Shanklin, 
Sweitzer and Mangione-Smith. 

The rejection is respectfully traversed. To establish a prima facie case of obviousness, 
three basic criteria must be met. First, there must be some suggestion or motivation, either in the 
references themselves or in the knowledge generally available to one of ordinary skill in the art, 
to modify the reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) must teach 
or suggest all the claim limitations. MPEP 2143, Basic Requirements of a Prima Facie Case of 
Obviousness. 

With respect to Claim 1, Sweitzer teaches a method of switching data rate by a DSL 
device, and describes a remote data transmission unit (DTU-R) state machine. The state machine 
waits for messages from a central data transmission unit (DTU-C). If the received message is 
not valid, the state machine moves to an error state, transmits a NAK packet to DTU-C and 
moves back to a valid state. Sweitzer, 9:63-10:12. Neither Sweitzer, nor FAnson, nor Shanklin 
either singly or in combination teaches "expressing as a second regular expression an invalid 
transition from the first state to the invalid state", and "applying to a received packet associated 
with the connection: the first regular expression to determine whether the packet is associated 
with the at least one valid transition, and the second regular expression to determine whether the 
packet is associated with the invalid transition." Thus, the prior art references do not teach or 
suggest all the claim limitations. Furthermore, Sweitzer teaches using state machines for 
switching a data rate by a DSL device (16:37-38). There is no suggestion or motivation in the 
references to combine Sweitzer's state machine with FAnson's protocol analyzer and Shanklin's 



Application Serial No. 09/964,272 
Attorney Docket No. RECOP0 1 8 



7 



intrusion detection signature analysis. As such, it is believed that the cited references have not 
met all the criteria required for establishing a prima facie case of obviousness, and that Claim 1 
is allowable. 

Claims 2-17 depend from claim 1 and are believed to be allowable for the same reasons 
described above. 

Similarly, with respect to claims 19, neither Sweitzer, nor F Anson, nor Shanklin either 
singly or in combination teaches a computer configured to apply to a received packet associated 
with the connection a first regular expression corresponding to a valid transition from the first 
state of the at least two valid states to a second state of the at least two states, and a second 
regular expression corresponding to an invalid transition from the first state of the at least two 
valid states to a predefined, invalid state. As such, claim 19 is believed to be allowable. 

Similarly, with respect to claims 20, neither Sweitzer, nor F Anson, nor Shanklin either 
singly or in combination teaches means for analyzing the network protocol stream by applying to 
a received packet associated with the connection a first regular expression corresponding to a 
valid transition from the first state of the at least two valid states to a second state of the at least 
two valid states and a second regular expression, the second regular expression corresponding to 
an invalid transition from the first state of the at least two valid states to a pre-defined, invalid 
state. As such, claim 20 is believed to be allowable. 

Similarly, with respect to claim 21, neither Sweitzer, nor F Anson, nor Shanklin either 
singly or in combination teaches expressing as a second regular expression an invalid transition 
from the first state to the invalid state and applying to a received packet associated with the 
connection the second regular expression to determine whether the packet is associated with the 
invalid transition. As such, claim 21 is believed to be allowable 

Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 
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Dated: 




Respectfully submitted, 




Diana Y. Fu 
Registration No\ 52,924 
V 408-973-2593 
F 408-973-2595 



VAN PELT, YI & JAMES LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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